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This action is responsive to the amendment and remarks file on 2/7/07. 
Claims 1-39 are amended are for further examination. 

DETAILED ACTION 
Response to Arguments 
Applicant's arguments filed 2/7/07 have been fully considered but they are not 
persuasive. 

Applicant argued that the art of record Sharon does not teach the newly amended claims 
which comprising the added limitation in the independent claims ".and is configurable to a 
monitoring mode or a focus mode to monitor and collect data" 

Examiner respectfully traversed the argument, Sharon, the cited art of record, teaches the 
media module/agent 12/software, which is configurable to a monitoring mode (refer to Col 6, 
Lines 45-67, Col 7, Lines 1-9) to perform the monitoring, analyzing and collect network traffic 
data (refer to Col 4, Lines 9-20). Agents are distributed throughout each segment of the network 
and collect and analyze traffic information (Col 5, Lines 15-25). It is being indicated that in 
Sharon, that the CME 12 (application server module) receive the information (collected data and 
analyzed data) from the agent 12 (Col 5, Lines 60-67, Col 7, Lines 10-25) and for configuring 
the at least one media module in response to the analyzed received data (triggers agents to 
collects more data in response to the received analyzed data, refer to Col 7, Lines 20-25, Lines 
40-50). 

Applicant argued that the combination of Sharon and Elliott is improper. 
Examiner respectfully traversed the argument. Sharon disclosed methods of monitoring 
network traffic in order to analyze and maintain the flow of traffic. Elliott provides system and 
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methods and one of the functionality of the system is to monitoring the system platform in order 
to maintain the system platform. However, Ellicott provides more functionality in term of 
network monitoring, and one of the function is accounting while providing monitoring the 
network resources and data flows, Elliott further provides accounting functionality due to the 
needs to provides the measurement and reporting of resource utilization from the accounting 
perspective. There's a need to provide the accounting perspective data information. There's a 
need for Sharon to implement such functions from Elliott, not only can Sharon's system gaining 
information from each accounting information from each segment information in order to 
determined services being utilized at each segment, but easier for user to understand the physical 
topology of the network traffic flow due to the accounting information that varies from segment 
to segment. Therefore, there is suggest/motivation to combine the references of Sharon and 
Elliott. 

Applicant has challenged the "Official Notice". 

Due to the challenged, Examiner presents the art "Sistanizadeh" to demonstrate that 
ordinary skill in the art would be motivated to comprise the limitation that is being stated in the 
instant application. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 
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I. Claims 1-11, 13-16, 18, 21-30, 32, 33, 35, and 38 and 39 are rejected under 35 
U.S.C. 102(b) as being anticipated by Sharon et al hereinafter Sharon (US 6,137,782). 

1. Referring to Claims 1, 23 and 39, Sharon indicates an application monitoring system (refer to 
abstract), comprising: (a) at least one media module (agent, network element, refer to Col 4, 
Lines 5-20, Col 3, Lines 40-67) coupled to an associated network segment (refer to Col 5, Lines 
9-25) on which a network application is running (refer to Col 3, Lines 50-67), each media 
module is adapted and configurable (media module comprises agents which are configurable, 
refer to Col 5, Lines 10-25, Col 6, Lines 1-20, Col 7, Lines 40-67) for monitoring and collecting 
data relating to traffic (refer to Col 2, Lines 1-35) on the associated network segment 
corresponding to the network application (software packages, refer to Col 1, Lines 54-67) and for 
analyzing the collected data for traffic information (refer to Col 3, Lines 50-67 and Col 5, Lines 
5-15), wherein each media module is tailored for network analysis (38, refer to Fig 2 and 
Abstract) and is configurable to a monitoring mode or a focus mode to monitor and collect data 
(refer to Col 6, Lines 45-67, Col 7, Lines 1-9) ; and (b) an application server module (CME, refer 
to Col 3, Lines 25-55) coupled to the at least one media module (network elements, agents, refer 
to Col 3, Lines 25-55) for receiving the collected data and the analyzed data (refer to Col 6, 
Lines 35-67 and Col 7, Lines 1-25) and the analyzing the data for improving the performance of 
the network application (software packages, refer to Col 1, Lines 50-67, Col 2, Lines 55-67; 
reducing the redundancy of collected data, refer to Col 5, Lines 5-25, which reduce unnecessary 
processing time by the CME) and for configuring the at least one media module in response to 
the analyzed received data (refer to Col 7, Lines 40-67). 
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2. Referring to Claims 2 and 24, Sharon indicates wherein the application server module (central 
communication server, 20, refer to Fig 1) provides (refer to Col 7, Lines 55-67) at least one of a 
user interface, provisioning, reports, alarms, statistics, and an SNMP agent (refer to Col 1 , Lines 
35-55). 

3 Referring to Claims 3 and 25, Sharon indicates wherein the user interface (GUI 28, refer to Col 
10, Lines 55-67) is accessible via Internet connection (refer to Col 8, Lines 10-25 and Col 10, 
Lines 14-65). 

4. Referring to Claim 4, Sharon indicates wherein the at least one media module (agent, network 
element, refer to Col 4, Lines 5-20, Col 3, Lines 40-67) includes at least two media modules of 
different types (agents "D" and "C" receiving information, analyzing information, refer to Col 4, 
Lines 5-20 and Col 1 1, Lines 20-50). 

5. Referring to Claims 5 and 27, Sharon discloses further comprising at least one additional 
media module (agent, network element, refer to Col 4, Lines 5-20, Col 3, Lines 40-67) that 
monitors network traffic not related to the network application (refer to Col 1, Lines 54-67). 

6. Referring to Claim 6, Sharon indicates wherein multiple media modules (agent 14, refer to Fig 
1) are coupled to a common chassis (CME, 12, refer to Fig 1). 
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7. Referring to Claim 7, Sharon indicates wherein the system is self-managed (automatic, refer to 
abstract). 

8. Referring to Claim 8, Sharon indicates wherein the system is remotely upgradeable (it is 
inherent that software are upgradeable, refer to Col 2, Lines 55-67 and Col 1, Lines 54-67). 

9. Referring to Claims 9 and 28, Sharon indicates wherein the application server module 
provides expert functions when analyzing the data (refer to Col 5, Lines 1-35 and Col 7, Lines 1- 
40). 

10. Referring to Claim 10 and 29, Sharon indicates wherein the application server module (CME, 
refer to Col 3, Lines 25-55 and Col 5, Lines 40-67) performs a security analysis (topology 
mapping, which is inherent that it consists a security/reliability functions, refer to Col 5, lines 1- 
35) based on the data. 

1 1 .Referring to Claims 1 1 and 30, Sharon indicates wherein the application server module (CME 
, refer to Col 3, Lines 25-55, Col 5, Lines 40-67) performs policy management functions 
(topology mapping, which is inherent that it also indicates where the packets are routed to, refer 
to Col 5, lines 1-35) when analyzing the data. 
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12. Referring to Claim 14, Sharon indicates wherein the application server module detects, 
configures, manages and downloads software to the at least one media module (refer to Col 4, 
Lines 5-20, and Col 6, Lines 35-60). 

13. Referring to Claim 22, Sharon indicates a computer program product for monitoring a 
network application (refer to Col 2, Lines 25-55), comprising: 

(a) computer code for monitoring and collecting data relating to traffic on a network segment 
corresponding to a network application (software packages, refer to Col 1, Lines 54-67) and for 
analyzing the collected data for traffic information (refer to Col 6, Lines 35-67 and Col 7, Lines 
1-25) utilizing a configurable (media module comprises agents which are configurable, refer to 
Col 5, Lines 10-25, Col 6, Lines 1-20, Col 7, Lines 40-67) media module tailored for network 
analysis (refer to Col 6, Lines 18-67); (b) computer code for receiving the data (refer to Col 6, 
Lines 1-20); and (c) computer code for analyzing the collected data and the analyzed data (refer 
to Col 5, Lines 1-40 and Col 6, Lines 45-67 and Col 7, Lines 1-25) for improving the 
performance of the network application utilizing an application server module (refer to Col 5, 
Lines 1-40). (d) computer code for configuring the media module in response to the analyzed 
data (refer to Col 7, Lines 40-67). 

14. Referring to Claims 13 and 32, Sharon indicates the server module the usage of software 
(server computers, refer to Col 3, Lines 25-55, and software packages, refer to Col 1, Lines 54- 
67) wherein trigger scripts (it is inherent that software package consists trigger scripts to analysis 
data) are used to customize the analysis of the data (refer to Col 5, Lines 1-10). 
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15. Referring to Claim 15, Sharon indicates wherein the at least one media module (agents 14, 
refer to Col 10, Lines 4-15) preprocesses the data (gathered traffic data information, refer to Col 
6, Lines 35-67) prior to receipt of the data by the application server module. 

16. Referring to Claim 16, Sharon indicates wherein the application server module includes a 
user interface server for managing interactions with a user (refer to Col 10, Lines 14-65), an 
object repository coupled to the user interface server for storing objects (refer to Col 10, Lines 
55-65), a configuration manager coupled to the user interface server for providing access to the 
objects (GUI thread 30, refer to Col 10, Lines 55-67), a remote network monitoring services 
subsystem (agent 14, refer to Col 11, Lines 1-15) coupled to the user interface system for 
providing remote access to the objects (traffic flow pattern, refer to Col 10, Lines 15-67), an 
expert server coupled to the object repository for analyzing data received from a media module 
(CME 12, refer to Col 45-67), and an administrative services subsystem coupled to the user 
interface server for providing administrative functions involving the objects (LMAP, refer to Col 
10, Lines 55-67). 

17. Referring to Claim 18, Sharon indicates wherein the at least one media module includes a 
data collection module for collecting data from a network segment (refer to Col 6, Lines 1-20) 
and prepending the data with descriptor information (CME 12, refer to Col 6, Lines 1-20), a flow 
processor for classifying the collected data into a plurality of flows (refer to Col 6, Lines 60-67), 
a capture buffer (queue, refer to Col 8, Lines 39-60) coupled to the flow processor (main thread 
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22) for filtering (refer to Col 8, Lines 38-60) and buffering the collected data in accordance with 
the flow processor, and a main processor for processing the collected data (LMAP module 1 8, 
refer to Col 8, Lines 38-60). 

18. Referring to Claim 35, Sharon indicates prepending the data collected from the network 
segment with descriptor information (refer to Col 6, Lines 1-20), classifying the collected data 
into a plurality of flows (sort data, refer to Col 7, Lines 1-10), filtering and buffering the 
collected data in accordance with the flow processor (data parser 34, refer to Col 7, Lines 1-10), 
and processing the collected data (analyzer, refer to Col 7, Lines 5-55). 

19. Referring to Claim 26, Sharon indicates further comprising simultaneously monitoring 
(multithread, refer to Col 8, Lines 39-50) different types of data (highest data rates to lowest, 
refer to Col 10, Lines 35-47) on multiple co-located network segments. 

20. Referring to Claim 33, Sharon indicates managing interactions with a user (refer to Col 10, 
Lines 20-65), storing objects (refer to Col 10, Lines 55-65), providing access to the objects 
(display data to user, refer to Col 10), providing remote access to the objects (accessing data 
through times, refer to Col 10), analyzing data received from a media module (traffic data 
gathered by media module, refer to Col 10), and providing administrative functions involving the 
objects (filtering, refer to Col 10). 
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21. Referring to Claims 21 and 38, Sharon indicates wherein the data analysis includes gathering 
performance data of the application during the monitoring (refer to Col 2, Lines 25-55 and Col 6, 
Lines 60-67); generating a set of metrics (records, refer to Col 8, Lines 40-67) in real time based 
on the performance data (refer to Col 8, Lines 39-67); and measuring a performance of the 
application from at least one of a client perspective, a server perspective, and a network 
perspective based on the metrics (refer to Col 8, Lines 10-60). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

II. Claims 12, 17, 19, 31, 34, and 36 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Sharon et al hereinafter Sharon (US 6,137,782) and Elliott et al hereinafter 
Elliott (US. 6,754,181). 

22. Referring to Claims 12 and 31, Sharon indicates wherein the application server module 
(server computers, refer to Col 3, Lines 25-55) performs several functions (refer to Col 8, Lines 
25-67 and Col 9 and Col 10). 

Sharon does not expressly indicate the server module indicates the accounting functions. 
Elliott discloses the accounting functions (refer to Col 24, Lines 1-25) 
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At the time of the invention, it would have been obvious to a person of ordinary skillin the art to 
combine Sharon and Elliott. 

The suggestion/motivation would have been that Sharon consists of network monitoring function 
to monitor traffic (refer to Col 6, Lines 40-67). Accounting function within network is 
considered to be type of traffic, it would make the system even more flexible to incorporate the 
accounting system within the Sharon and useful 

23. Referring to Claims 17 and 34, Sharon indicates wherein the application server module (44, 
refer to Fig 2) discloses a registry services subsystem for associating an object with at least one 
of a user and the server system (refer to Col 3, Col 4, Col 8, Col 9, and Col 10 and Fig 2) , a 
triggers manager for managing triggers (refer to Col 7), and a hardware services subsystem for 
providing communication between the server system and external modules (refer to Col 3, 4, 5 
and 6). 

Elliott discloses wherein the application server module includes at least one of a logging 
manager for storing logging information, a statistics manager for dispatching statistics, an alarm 
manager for dispatching alarms (refer to Col 109, 1 10 and 1 1 1), an event manager for 
dispatching events (refer to Col 1 1 1), a capture manager subsystem for creating trace files (refer 
to Col 99 and Col 101), a session manager for managing a user session (refer to Col 94), a 
security manager for providing authorization levels to users (refer to Col 93 and 94 and 95). 
At the time of the invention, it would have been obvious to a person of ordinary skill in the art to 
combine Sharon and Elliott. 
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The suggestion/motivation would have been that Sharon indicates the security of the network 
system (refer to Col 6). He also indicates the usage of monitoring traffic system utilizing the 
CME 12, servers and other network elements (refer to Col 5). It would be easier for the network 
management to have all the separate functions to be managed by each individual manager and 
process at the same time (multithread, refer to Col 8). To decrease the processing time. 

24, Referring to Claims 19 and 36, Sharon indicates wherein the at least one media module 
performs filtering functions (refer to Col 6, Lines 60-67) and network segment (refer to Col 5 5 
Lines 9-25). He also indicates the usage of queue for store information (refer to Col 8, Lines 35- 
60) and threshold (refer to Col 10, Lines 35-50). Sharon also define the system is able to 
determine/monitor maximum data storage (refer to Col 8, Lines 25-40). 
SHARON does not expressly indicate filtering comprising: (i.) classifying the data in the 
network segment into multiple flows; (ii.) prioritizing the flows into high and low priority flows; 
(iii.) monitoring an-amount of data in the high priority flows (refer to Col 20, Lines 1-45); and 
(iv.) reallocating resources from the low priority queue to the high priority queue if the amount 
of data in the high priority flows surpasses a predetermined threshold. 
Elliott discloses usage of (i.) classifying the data in the network segment into multiple flows 
(refer to Col 19, Lines 55-67 and Col 20); (ii.) prioritizing the flows into high and low priority 
flows (priority tag and non-tagged, refer to Col 19, Lines 55-67); (iii.) monitoring flows (refer to 
Col 20, Lines 30-45); and (iv.) reallocating resources from the low priority queue to the high 
priority queue if the amount of data in the high priority flows surpasses a predetermined 
threshold (refer to Col 26, Lines 20-67 and Col 111). 



Application/Control Number: 10/043,501 Page 13 

Art Unit: 2151 

At the time of the invention, it would have been obvious to a person of ordinary skill in the art to 
combine Sharon and Elliott. 

The suggestion and motivation for doing so would have been that Sharon indicate the system 
consists functionality of monitoring the traffic and filtered them according to the traffic data 
characteristic (refer to Col 6 and Col 7). By classify the traffic into various flows, and reallocate 
the resource as necessary, add the flexibility and can void traffic backlog within the system. 

III. Claims 20 and 37 rejected under 35 U.S.C. 103(a) as being unpatentable over Sharon 
et al hereinafter Sharon (US 6,137,782) in view of Sistanizadeh et al hereinafter Sistanizadeh 
(US 6,681,232) 

25. Referring to Claims 20 and 37, Sharon indicates wherein the analysis of the data by the 
application server module includes creating reports (refer to Col 8, Lines 25-40) based on the 
monitored data, and output the reports to a user (refer to Col 10, Lines 35-65). 
Sharon does not expressly indicate of utilizing graphs and logs as part of the reports. 
Sistanizadeh disclosed utilizing graphs and logs as part of the report (refer to Col 21, Lines 1- 
15). 

At the time of the invention, it would have been obvious to a person of ordinary skill in the art to 
combine the Sharon and Sistanizadeh since Sharon disclosed the important of utilizing the 
reports to present the monitored data and furthermore by utilizing Sistanizadeh 's system, it 
provides better interface for customer to understand the network better. 
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The suggestion/motivation would have been the by incorporate graphs and logs within the 
reports, provides conveniences to the user to understand the data more clearly. 

Conclusion 

Examiner's Notes: Examiner has cited particular columns and line numbers in the 
references applied to the claims above for the convenience of the applicant. Although the 
specified citations are representative of the teachings of the art and are applied to specific 
limitations within the individual claim, other passages and figures may apply as well. It is 
respectfully requested from the applicant in preparing responses, to fully consider the references 
in entirety as potentially teaching all or part of the claimed invention, as well as the context of 
the passage as taught by the prior art or disclosed by the Examiner. In the case of amending the 
claimed invention, Applicant is respectfully requested to indicate the portion(s) of the 
specification which dictate(s) the structure relied on for proper interpretation and also to verify 
and ascertain the metes and bounds of the claimed invention. 

Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is • 
reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event,' 
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however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Karen C. Tang whose telephone number is (571)272-31 16. The 
examiner can normally be reached on M-F 7-3. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Zarni Maung can be reached on (571)272-3939. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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